A sophisticated malware framework dubbed “Tsunami” has emerged as an active threat, targeting users through a multi-stage infection chain and deploying an extensive arsenal of credential stealing and cryptomining capabilities. Security researchers have linked this malware to the ongoing “Contagious Interview” campaign associated with North Korean threat actors, specifically the Lazarus Group. Their analysis revealed that the malware relies on both the TOR network and Pastebin for command and control (C2) operations, demonstrating the threat actors’ efforts to maintain operational security while actively developing new tooling. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The Tsunami malware employs a modular structure with over 25 different components, including multiple browser credential stealers targeting Chrome, Firefox, Brave, Edge, and OperaGX. The attack begins with initial access through the chainloading of a malicious BeaverTail payload from a third-party domain, “api.npoint.io,” via a compromised private GitHub repository. The Python-based launcher creates a “Windows Update Script.pyw” file in the Windows startup folder and installs a “Runtime Broker.exe” in a Microsoft Windows Applications directory. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Upon closer examination of Tsunami’s persistence mechanisms, the malware demonstrates sophisticated techniques to maintain access to compromised systems. According to the research, the malware’s development appears to be ongoing, with some modules like the botnet functionality still in early stages of implementation, suggesting the threat actors are continuously enhancing their capabilities. The malware further implements extensive defense evasion by adding multiple Windows Defender exclusions and Windows Firewall rules.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 29 Apr 2025 12:50:05 +0000